Movatterモバイル変換

[0]ホーム
URL:

  1. Home
  2. Groups
  3. Chimera

Chimera

Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.[1][2]

ID: G0114
Version: 2.2
Created: 24 August 2020
Last Modified: 12 September 2024
Enterprise Layer
downloadview

Techniques Used

DomainIDNameUse
EnterpriseT1087.001Account Discovery:Local Account

Chimera has usednet user for account discovery.[2]

.002Account Discovery:Domain Account

Chimera has has usednet user /dom andnet user Administrator to enumerate domain accounts including administrator accounts.[1][2]

EnterpriseT1071.001Application Layer Protocol:Web Protocols

Chimera has used HTTPS for C2 communications.[2]

.004Application Layer Protocol:DNS

Chimera has usedCobalt Strike to encapsulate C2 in DNS traffic.[2]

EnterpriseT1560.001Archive Collected Data:Archive via Utility

Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.[1][2]

EnterpriseT1119Automated Collection

Chimera has used custom DLLs for continuous retrieval of data from memory.[2]

EnterpriseT1217Browser Information Discovery

Chimera has usedtype \\c$\Users\\Favorites\Links\Bookmarks bar\Imported From IE*citrix* for bookmark discovery.[2]

EnterpriseT1110.003Brute Force:Password Spraying

Chimera has used multiple password spraying attacks against victim's remote services to obtain valid user and administrator accounts.[2]

.004Brute Force:Credential Stuffing

Chimera has used credential stuffing against victim's remote services to obtain valid accounts.[2]

EnterpriseT1059.001Command and Scripting Interpreter:PowerShell

Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features.[1][2]

.003Command and Scripting Interpreter:Windows Command Shell

Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.[2]

EnterpriseT1213.002Data from Information Repositories:Sharepoint

Chimera has collected documents from the victim's SharePoint.[2]

EnterpriseT1039Data from Network Shared Drive

Chimera has collected data of interest from network shares.[2]

EnterpriseT1074.001Data Staged:Local Data Staging

Chimera has staged stolen data locally on compromised hosts.[2]

.002Data Staged:Remote Data Staging

Chimera has staged stolen data on designated servers in the target environment.[2]

EnterpriseT1482Domain Trust Discovery

Chimera hasnltest /domain_trusts to identify domain trust relationships.[2]

EnterpriseT1114.001Email Collection:Local Email Collection

Chimera has harvested data from victim's e-mail including through execution ofwmic /node: process call create "cmd /c copy c:\Users\\\backup.pst c:\windows\temp\backup.pst" copy "i:\\\My Documents\.pst"
copy.[2]

.002Email Collection:Remote Email Collection

Chimera has harvested data from remote mailboxes including through execution of\\c$\Users\\AppData\Local\Microsoft\Outlook*.ost.[2]

EnterpriseT1041Exfiltration Over C2 Channel

Chimera has usedCobalt Strike C2 beacons for data exfiltration.[2]

EnterpriseT1567.002Exfiltration Over Web Service:Exfiltration to Cloud Storage

Chimera has exfiltrated stolen data to OneDrive accounts.[2]

EnterpriseT1133External Remote Services

Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.[1][2]

EnterpriseT1083File and Directory Discovery

Chimera has utilized multiple commands to identify data of interest in file and directory listings.[2]

EnterpriseT1589.001Gather Victim Identity Information:Credentials

Chimera has collected credentials for the target organization from previous breaches for use in brute force attacks.[2]

EnterpriseT1574.001Hijack Execution Flow:DLL

Chimera has used side loading to place malicious DLLs in memory.[2]

EnterpriseT1070.001Indicator Removal:Clear Windows Event Logs

Chimera has cleared event logs on compromised hosts.[2]

.004Indicator Removal:File Deletion

Chimera has performed file deletion to evade detection.[1]

.006Indicator Removal:Timestomp

Chimera has used a Windows version of the Linuxtouch command to modify the date and time stamp on DLLs.[2]

EnterpriseT1105Ingress Tool Transfer

Chimera has remotely copied tools and malware onto targeted systems.[1]

EnterpriseT1570Lateral Tool Transfer

Chimera has copied tools between compromised hosts using SMB.[2]

EnterpriseT1680Local Storage Discovery

Chimera has usedfsutil fsinfo drives,systeminfo, andvssadmin list shadows for system information including shadow volumes and drive information.[2]

EnterpriseT1036.005Masquerading:Match Legitimate Resource Name or Location

Chimera has renamed malware to GoogleUpdate.exe and WinRAR to jucheck.exe, RecordedTV.ms, teredo.tmp, update.exe, and msadcs1.exe.[1]

EnterpriseT1556.001Modify Authentication Process:Domain Controller Authentication

Chimera's malware has altered the NTLM authentication program on domain controllers to allowChimera to login without a valid credential.[1]

EnterpriseT1111Multi-Factor Authentication Interception

Chimera has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.[2]

EnterpriseT1106Native API

Chimera has used direct Windows system calls by leveraging Dumpert.[1]

EnterpriseT1046Network Service Discovery

Chimera has used theget -b -e -p command for network scanning as well as a custom Python tool packed into a Windows executable named Get.exe to scan IP ranges for HTTP.[2]

EnterpriseT1135Network Share Discovery

Chimera has usednet share andnet view to identify network shares of interest.[2]

EnterpriseT1027.010Obfuscated Files or Information:Command Obfuscation

Chimera has encoded PowerShell commands.[1]

EnterpriseT1588.002Obtain Capabilities:Tool

Chimera has obtained and used tools such asBloodHound,Cobalt Strike,Mimikatz, andPsExec.[1][2]

EnterpriseT1003.003OS Credential Dumping:NTDS

Chimera has gathered the SYSTEM registry and ntds.dit files from target systems.[1]Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users viamsadcs.exe "NTDS.dit" -s "SYSTEM" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv and used ntdsutil to copy the Active Directory database.[2]

EnterpriseT1201Password Policy Discovery

Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.[2]

EnterpriseT1069.001Permission Groups Discovery:Local Groups

Chimera has usednet localgroup administrators to identify accounts with local administrative rights.[2]

EnterpriseT1057Process Discovery

Chimera has usedtasklist to enumerate processes.[2]

EnterpriseT1572Protocol Tunneling

Chimera has encapsulatedCobalt Strike's C2 protocol in DNS and HTTPS.[2]

EnterpriseT1012Query Registry

Chimera has queried Registry keys usingreg query \\HKU\\SOFTWARE\Microsoft\Terminal Server Client\Servers andreg query \\HKU\\Software\Microsoft\Windows\CurrentVersion\Internet Settings.[2]

EnterpriseT1021.001Remote Services:Remote Desktop Protocol

Chimera has used RDP to access targeted systems.[1]

.002Remote Services:SMB/Windows Admin Shares

Chimera has used Windows admin shares to move laterally.[1][2]

.006Remote Services:Windows Remote Management

Chimera has used WinRM for lateral movement.[2]

EnterpriseT1018Remote System Discovery

Chimera has utilized various scans and queries to find domain controllers and remote services in the target environment.[2]

EnterpriseT1053.005Scheduled Task/Job:Scheduled Task

Chimera has used scheduled tasks to invoke Cobalt Strike including through batch scriptschtasks /create /ru "SYSTEM" /tn "update" /tr "cmd /c c:\windows\temp\update.bat" /sc once /f /st and to maintain persistence.[1][2]

EnterpriseT1016System Network Configuration Discovery

Chimera has usedipconfig,Ping, andtracert to enumerate the IP address and network environment and settings of the local host.[2]

EnterpriseT1049System Network Connections Discovery

Chimera has usednetstat -ano | findstr EST to discover network connections.[2]

EnterpriseT1033System Owner/User Discovery

Chimera has used thequser command to show currently logged on users.[2]

EnterpriseT1007System Service Discovery

Chimera has usednet start andnet use for system service discovery.[2]

EnterpriseT1569.002System Services:Service Execution

Chimera has usedPsExec to deploy beacons on compromised systems.[2]

EnterpriseT1124System Time Discovery

Chimera has usedtime /t andnet time \ip/hostname for system time discovery.[2]

EnterpriseT1550.002Use Alternate Authentication Material:Pass the Hash

Chimera has dumped password hashes for use in pass the hash authentication attacks.[2]

EnterpriseT1078Valid Accounts

Chimera has used a valid account to maintain persistence via scheduled task.[1]

.002Domain Accounts

Chimera has used compromised domain accounts to gain access to the target environment.[2]

EnterpriseT1047Windows Management Instrumentation

Chimera has used WMIC to execute remote commands.[1][2]

Software

IDNameReferencesTechniques
S0521BloodHound[1]Account Discovery:Domain Account,Account Discovery:Local Account,Archive Collected Data,Command and Scripting Interpreter:PowerShell,Domain Trust Discovery,Group Policy Discovery,Native API,Permission Groups Discovery:Domain Groups,Permission Groups Discovery:Local Groups,Remote System Discovery,System Owner/User Discovery
S0154Cobalt Strike[1][2]Abuse Elevation Control Mechanism:Sudo and Sudo Caching,Abuse Elevation Control Mechanism:Bypass User Account Control,Access Token Manipulation:Parent PID Spoofing,Access Token Manipulation:Token Impersonation/Theft,Access Token Manipulation:Make and Impersonate Token,Account Discovery:Domain Account,Application Layer Protocol:DNS,Application Layer Protocol:Web Protocols,Application Layer Protocol:File Transfer Protocols,BITS Jobs,Browser Session Hijacking,Command and Scripting Interpreter:JavaScript,Command and Scripting Interpreter:Visual Basic,Command and Scripting Interpreter:PowerShell,Command and Scripting Interpreter:Python,Command and Scripting Interpreter:Windows Command Shell,Create or Modify System Process:Windows Service,Data Encoding:Standard Encoding,Data from Local System,Data Obfuscation:Protocol or Service Impersonation,Data Transfer Size Limits,Deobfuscate/Decode Files or Information,Encrypted Channel:Asymmetric Cryptography,Encrypted Channel:Symmetric Cryptography,Exploitation for Client Execution,Exploitation for Privilege Escalation,File and Directory Discovery,Hide Artifacts:Process Argument Spoofing,Impair Defenses:Disable or Modify Tools,Indicator Removal:Timestomp,Ingress Tool Transfer,Input Capture:Keylogging,Modify Registry,Native API,Network Service Discovery,Network Share Discovery,Non-Application Layer Protocol,Obfuscated Files or Information:Indicator Removal from Tools,Obfuscated Files or Information,Office Application Startup:Office Template Macros,OS Credential Dumping:LSASS Memory,OS Credential Dumping:Security Account Manager,Permission Groups Discovery:Domain Groups,Permission Groups Discovery:Local Groups,Process Discovery,Process Injection:Dynamic-link Library Injection,Process Injection:Process Hollowing,Process Injection,Protocol Tunneling,Proxy:Domain Fronting,Proxy:Internal Proxy,Query Registry,Reflective Code Loading,Remote Services:Remote Desktop Protocol,Remote Services:SSH,Remote Services:Windows Remote Management,Remote Services:SMB/Windows Admin Shares,Remote Services:Distributed Component Object Model,Remote System Discovery,Scheduled Transfer,Screen Capture,Software Discovery,Subvert Trust Controls:Code Signing,System Binary Proxy Execution:Rundll32,System Network Configuration Discovery,System Network Connections Discovery,System Service Discovery,System Services:Service Execution,Use Alternate Authentication Material:Pass the Hash,Valid Accounts:Domain Accounts,Valid Accounts:Local Accounts,Windows Management Instrumentation
S0404esentutl[2]Data from Local System,Direct Volume Access,Hide Artifacts:NTFS File Attributes,Ingress Tool Transfer,Lateral Tool Transfer,OS Credential Dumping:NTDS
S0002Mimikatz[1][2]Access Token Manipulation:SID-History Injection,Account Manipulation,Boot or Logon Autostart Execution:Security Support Provider,Credentials from Password Stores,Credentials from Password Stores:Credentials from Web Browsers,Credentials from Password Stores:Windows Credential Manager,OS Credential Dumping:DCSync,OS Credential Dumping:Security Account Manager,OS Credential Dumping:LSASS Memory,OS Credential Dumping:LSA Secrets,Rogue Domain Controller,Steal or Forge Authentication Certificates,Steal or Forge Kerberos Tickets:Golden Ticket,Steal or Forge Kerberos Tickets:Silver Ticket,Unsecured Credentials:Private Keys,Use Alternate Authentication Material:Pass the Hash,Use Alternate Authentication Material:Pass the Ticket
S0039Net[2]Account Discovery:Domain Account,Account Discovery:Local Account,Account Manipulation:Additional Local or Domain Groups,Create Account:Local Account,Create Account:Domain Account,Indicator Removal:Network Share Connection Removal,Network Share Discovery,Password Policy Discovery,Permission Groups Discovery:Domain Groups,Permission Groups Discovery:Local Groups,Remote Services:SMB/Windows Admin Shares,Remote System Discovery,System Network Connections Discovery,System Service Discovery,System Services:Service Execution,System Time Discovery
S0029PsExec[2]Create Account:Domain Account,Create or Modify System Process:Windows Service,Lateral Tool Transfer,Remote Services:SMB/Windows Admin Shares,System Services:Service Execution

References

×
[8]ページ先頭
©2009-2026 Movatter.jp